IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AFHIEBKKFHIEGCAKECGH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\DAFHIDGIJKJKECBGDBGHDBKFHI
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\FHCGHJDB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\FHCGHJDBFIIDGDHIJDBG
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\FIDGHIIECGHDHJKFCAEGIJDGCB
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\GIJKKKFC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HJKKFIJKFCAKJJJKJKFIEBFIDG
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KFIJJEGHDAEBGCAKJKFH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KJJJKFIIIJJJECAAEHDBFHJEGD
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll6
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdowsApps
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllJ
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllx
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpr
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpla
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpf
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37i
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpV
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpX
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllS
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllK
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllO
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php914V
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 41 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
13DE000
heap
page read and write
 malicious
7A1000
unkown
page execute and read and write
 malicious
51A0000
direct allocation
page read and write
 malicious
303B000
stack
page read and write
6C650000
unkown
page readonly
1D60D000
stack
page read and write
B8D000
unkown
page execute and read and write
3E0E000
stack
page read and write
1D940000
heap
page read and write
23A24000
heap
page read and write
4D11000
heap
page read and write
6C88F000
unkown
page readonly
3F0F000
stack
page read and write
33CF000
stack
page read and write
4A5F000
stack
page read and write
4D11000
heap
page read and write
4D11000
heap
page read and write
4D11000
heap
page read and write
1D91D000
heap
page read and write
851000
unkown
page execute and read and write
CA8000
unkown
page execute and write copy
1D91B000
heap
page read and write
1D941000
heap
page read and write
F0C000
stack
page read and write
1D924000
heap
page read and write
1D91A000
heap
page read and write
4D11000
heap
page read and write
2DAD000
stack
page read and write
6C8D5000
unkown
page readonly
1D91A000
heap
page read and write
5310000
direct allocation
page execute and read and write
29A74000
heap
page read and write
3F4E000
stack
page read and write
350F000
stack
page read and write
29A8E000
heap
page read and write
825000
unkown
page execute and read and write
4D00000
direct allocation
page read and write
23ACF000
heap
page read and write
6C6DE000
unkown
page read and write
1DA15000
heap
page read and write
4D00000
direct allocation
page read and write
495E000
stack
page read and write
1D91B000
heap
page read and write
404F000
stack
page read and write
832000
unkown
page execute and read and write
13D0000
heap
page read and write
1D928000
heap
page read and write
532E000
stack
page read and write
4D11000
heap
page read and write
1D928000
heap
page read and write
1D92C000
heap
page read and write
1D74C000
stack
page read and write
4D00000
direct allocation
page read and write
4D10000
heap
page read and write
1D35E000
stack
page read and write
4D11000
heap
page read and write
4D11000
heap
page read and write
1D919000
heap
page read and write
4D00000
direct allocation
page read and write
4D11000
heap
page read and write
61ED0000
direct allocation
page read and write
4D11000
heap
page read and write
4D00000
direct allocation
page read and write
1D919000
heap
page read and write
4D11000
heap
page read and write
29A7C000
heap
page read and write
14C1000
heap
page read and write
1D924000
heap
page read and write
4D11000
heap
page read and write
4D11000
heap
page read and write
390E000
stack
page read and write
1D940000
heap
page read and write
4D11000
heap
page read and write
1D91B000
heap
page read and write
7A1000
unkown
page execute and write copy
29AC8000
heap
page read and write
1D940000
heap
page read and write
1D928000
heap
page read and write
1D940000
heap
page read and write
6C651000
unkown
page execute read
4CDF000
stack
page read and write
1D940000
heap
page read and write
4D11000
heap
page read and write
85D000
unkown
page execute and read and write
8AF000
unkown
page execute and read and write
4D11000
heap
page read and write
4D30000
heap
page read and write
4D11000
heap
page read and write
4E10000
trusted library allocation
page read and write
C99000
unkown
page execute and read and write
965000
unkown
page execute and read and write
6C8CF000
unkown
page write copy
1D924000
heap
page read and write
1D924000
heap
page read and write
1D916000
heap
page read and write
1D931000
heap
page read and write
4D00000
direct allocation
page read and write
1D931000
heap
page read and write
4D11000
heap
page read and write
307E000
stack
page read and write
354E000
stack
page read and write
4D11000
heap
page read and write
52F0000
direct allocation
page execute and read and write
430E000
stack
page read and write
1D924000
heap
page read and write
1D93F000
heap
page read and write
468F000
stack
page read and write
1D90A000
heap
page read and write
1D940000
heap
page read and write
46CE000
stack
page read and write
1D25E000
stack
page read and write
945000
unkown
page execute and read and write
418F000
stack
page read and write
318F000
stack
page read and write
1D940000
heap
page read and write
2FFF000
stack
page read and write
51DC000
stack
page read and write
4D00000
direct allocation
page read and write
4D11000
heap
page read and write
4D11000
heap
page read and write
1D924000
heap
page read and write
2FCB5000
heap
page read and write
2FC10000
trusted library allocation
page read and write
1D928000
heap
page read and write
51A0000
direct allocation
page read and write
3B8E000
stack
page read and write
4D00000
direct allocation
page read and write
1D924000
heap
page read and write
4D11000
heap
page read and write
F80000
heap
page read and write
3C8F000
stack
page read and write
1D93B000
heap
page read and write
1D8ED000
stack
page read and write
29A76000
heap
page read and write
1D90A000
heap
page read and write
1422000
heap
page read and write
882000
unkown
page execute and read and write
1D920000
heap
page read and write
1D90A000
heap
page read and write
3B4F000
stack
page read and write
1D924000
heap
page read and write
4D00000
direct allocation
page read and write
1D922000
heap
page read and write
29A91000
heap
page read and write
1D941000
heap
page read and write
4D11000
heap
page read and write
29A72000
heap
page read and write
4D11000
heap
page read and write
490F000
stack
page read and write
61EB4000
direct allocation
page read and write
1D919000
heap
page read and write
4D11000
heap
page read and write
5300000
direct allocation
page execute and read and write
368E000
stack
page read and write
5320000
direct allocation
page execute and read and write
1D924000
heap
page read and write
4D11000
heap
page read and write
4D11000
heap
page read and write
1D90A000
heap
page read and write
2FCAE000
heap
page read and write
13DA000
heap
page read and write
1D927000
heap
page read and write
2FC0E000
stack
page read and write
4D11000
heap
page read and write
8BE000
unkown
page execute and read and write
2398C000
heap
page read and write
1D924000
heap
page read and write
1D92C000
heap
page read and write
61ECD000
direct allocation
page readonly
4D11000
heap
page read and write
1457000
heap
page read and write
1D0DF000
stack
page read and write
2EAE000
stack
page read and write
1D8F6000
heap
page read and write
96B000
unkown
page execute and read and write
4D11000
heap
page read and write
4D11000
heap
page read and write
12F3000
stack
page read and write
4CE0000
heap
page read and write
1D940000
heap
page read and write
1D92B000
heap
page read and write
4D11000
heap
page read and write
7A0000
unkown
page readonly
6C8D0000
unkown
page read and write
828000
unkown
page execute and read and write
E49000
unkown
page execute and read and write
1D919000
heap
page read and write
1D909000
heap
page read and write
1D916000
heap
page read and write
37CE000
stack
page read and write
143B000
heap
page read and write
4D11000
heap
page read and write
1D64E000
stack
page read and write
47CF000
stack
page read and write
4D11000
heap
page read and write
2FCBD000
heap
page read and write
1D924000
heap
page read and write
2FCB4000
heap
page read and write
1D931000
heap
page read and write
29A88000
heap
page read and write
42CF000
stack
page read and write
1D919000
heap
page read and write
1D90A000
heap
page read and write
61EB7000
direct allocation
page readonly
1D931000
heap
page read and write
1D931000
heap
page read and write
4D00000
direct allocation
page read and write
4D11000
heap
page read and write
5320000
direct allocation
page execute and read and write
4D00000
direct allocation
page read and write
1D905000
heap
page read and write
4BDE000
stack
page read and write
1D924000
heap
page read and write
1D90A000
heap
page read and write
F60000
heap
page read and write
12FD000
stack
page read and write
1D919000
heap
page read and write
29AD1000
heap
page read and write
4D11000
heap
page read and write
4D26000
heap
page read and write
1D93F000
heap
page read and write
1D924000
heap
page read and write
4D11000
heap
page read and write
6C6CD000
unkown
page readonly
1D916000
heap
page read and write
1D11E000
stack
page read and write
4D11000
heap
page read and write
1418000
heap
page read and write
29AB1000
heap
page read and write
32CE000
stack
page read and write
1D93C000
heap
page read and write
1D931000
heap
page read and write
88F000
unkown
page execute and read and write
1D940000
heap
page read and write
1D924000
heap
page read and write
4D11000
heap
page read and write
340E000
stack
page read and write
29A50000
heap
page read and write
1D919000
heap
page read and write
364F000
stack
page read and write
1D93B000
heap
page read and write
1D8F0000
heap
page read and write
1D924000
heap
page read and write
1D909000
heap
page read and write
61E01000
direct allocation
page execute read
3080000
heap
page read and write
1D919000
heap
page read and write
1D924000
heap
page read and write
FEE000
stack
page read and write
1D924000
heap
page read and write
1D920000
heap
page read and write
CA8000
unkown
page execute and read and write
1D7ED000
stack
page read and write
C66000
unkown
page execute and read and write
4D11000
heap
page read and write
4D11000
heap
page read and write
1D8FF000
heap
page read and write
1D90B000
heap
page read and write
61ECC000
direct allocation
page read and write
4D11000
heap
page read and write
6C6E2000
unkown
page readonly
2EFE000
stack
page read and write
29A85000
heap
page read and write
4D11000
heap
page read and write
1D928000
heap
page read and write
1D924000
heap
page read and write
480E000
stack
page read and write
4D11000
heap
page read and write
1D927000
heap
page read and write
15CE000
stack
page read and write
6C8CE000
unkown
page read and write
2FCA6000
heap
page read and write
4D11000
heap
page read and write
4D11000
heap
page read and write
9FE000
unkown
page execute and read and write
7A0000
unkown
page read and write
4D11000
heap
page read and write
4D11000
heap
page read and write
38CF000
stack
page read and write
1D91D000
heap
page read and write
4D11000
heap
page read and write
328F000
stack
page read and write
4D11000
heap
page read and write
444E000
stack
page read and write
2FB0E000
stack
page read and write
378F000
stack
page read and write
1D931000
heap
page read and write
4D00000
direct allocation
page read and write
1D931000
heap
page read and write
61ED3000
direct allocation
page read and write
F65000
heap
page read and write
4D11000
heap
page read and write
308B000
heap
page read and write
308E000
heap
page read and write
4D11000
heap
page read and write
3CCE000
stack
page read and write
4D11000
heap
page read and write
4D20000
heap
page read and write
1D931000
heap
page read and write
1D941000
heap
page read and write
6C6F0000
unkown
page readonly
3A4E000
stack
page read and write
4D11000
heap
page read and write
3087000
heap
page read and write
4B9F000
stack
page read and write
E4A000
unkown
page execute and write copy
1D931000
heap
page read and write
1D920000
heap
page read and write
61ED4000
direct allocation
page readonly
4D11000
heap
page read and write
458E000
stack
page read and write
440E000
stack
page read and write
1D924000
heap
page read and write
1D91A000
heap
page read and write
4D11000
heap
page read and write
4D11000
heap
page read and write
4D11000
heap
page read and write
3DCF000
stack
page read and write
F70000
heap
page read and write
4D11000
heap
page read and write
12F9000
stack
page read and write
1D921000
heap
page read and write
4D11000
heap
page read and write
1D93E000
heap
page read and write
61E00000
direct allocation
page execute and read and write
82F000
unkown
page execute and read and write
1D924000
heap
page read and write
7FA000
unkown
page execute and read and write
4D11000
heap
page read and write
4D11000
heap
page read and write
CA9000
unkown
page execute and write copy
408E000
stack
page read and write
4D00000
direct allocation
page read and write
4D11000
heap
page read and write
1D924000
heap
page read and write
1D3BE000
stack
page read and write
52DF000
stack
page read and write
51A0000
direct allocation
page read and write
1D924000
heap
page read and write
1D927000
heap
page read and write
454F000
stack
page read and write
4D11000
heap
page read and write
4D11000
heap
page read and write
1D931000
heap
page read and write
1D940000
heap
page read and write
29A71000
heap
page read and write
1D928000
heap
page read and write
5330000
direct allocation
page execute and read and write
1D908000
heap
page read and write
3A0F000
stack
page read and write
5340000
direct allocation
page execute and read and write
29A30000
heap
page read and write
4D00000
direct allocation
page read and write
1D919000
heap
page read and write
1D21F000
stack
page read and write
41CE000
stack
page read and write
1D918000
heap
page read and write
4D11000
heap
page read and write
1D91A000
heap
page read and write
1D4BF000
stack
page read and write
1D924000
heap
page read and write
4A9E000
stack
page read and write
4D11000
heap
page read and write
1D50E000
stack
page read and write
1D922000
heap
page read and write
8BB000
unkown
page execute and read and write
1D928000
heap
page read and write
1D91D000
heap
page read and write
4D11000
heap
page read and write
C8F000
unkown
page execute and read and write
1D921000
heap
page read and write
4D11000
heap
page read and write
1D919000
heap
page read and write
1DA10000
trusted library allocation
page read and write
6C6F1000
unkown
page execute read
4910000
heap
page read and write
4D11000
heap
page read and write
There are 367 hidden memdumps, click here to show them.